No, it was a user. He was online when I found out about it, and in the administration panel I can not only see who's online, but what they are doing. The spammer was in the PM section when I booted him.